Cisco ASA Reload Flaw CVE-2026-76418 Is Under Attack, With a Three-Day CISA Deadline

An unauthenticated remote attacker can reload a Cisco ASA or FTD firewall through its SSL VPN when a tunnel group uses secondary authentication, and Cisco says attackers did so in October.

Cisco published the advisory (cisco-sa-asaftd-tunnel-dos-s6mgkb75) on October 28, 2026 at 19:15 GMT. It tracks the flaw as CVE-2026-76418, bug ID CSCwx26625. CISA's catalog shows the agency added it on October 29 with a due date of November 1, a three-day window for federal civilian agencies.

What a vulnerable CVE-2026-76418 configuration looks like

Two things have to be true in the running configuration. SSL VPN must be enabled on at least one interface (the webvpn block with enable <interface_name>), and a tunnel group must set secondary-authentication-server-group.

The second condition is easy to miss. If tunnel-group-list enable is configured, Cisco says to check every tunnel group. If the list is absent, the default group, DefaultWEBVPNGroup, still has to be checked. Network World reported that removing the list "does not remove exposure" when that default group uses secondary authentication.

Cisco's advisory says a successful VPN login is not required to reach the affected code path. The root cause, in Cisco's words quoted by Network World, is "logic errors when secondary authentication is configured on a tunnel group." The weakness class is CWE-690, an unchecked return value leading to a NULL pointer dereference.

Fixed releases from ASA 9.16.4.104 to FTD 10.1.1

Cisco lists a first fixed release for each train. ASA 9.24 has two entries.

ASA release	First fixed	FTD release	First fixed
9.16 and earlier	9.16.4.104	7.0 and earlier	7.0.11
9.18	9.18.4.96	7.2	7.2.13
9.20	9.20.4.50	7.4	7.4.9
9.22	9.22.3.200	7.6	7.6.7
9.23	9.23.1.48	7.7	7.7.14
9.24	9.24.1.27 or 9.24.10.1	10.0	10.0.3
		10.1	10.1.1

Cisco says Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software are not affected.

The 8.6 score and the "no workarounds" line

The score is 8.6 on CVSS 3.1 (AV:N/AC:L/PR:N/S:C/C:N/I:N/A:H). That rests on a network vector, no privileges and a changed scope. Confidentiality and integrity are both rated none. Nothing in the advisory describes code execution or data access.

The score understates the operational cost for a site whose remote workforce enters through that appliance, because a firewall that reloads takes its VPN with it, and Cisco says exploitation was observed.

The advisory contradicts itself on remedies. It says "There are no workarounds that address this vulnerability," then gives a mitigation in two cases. If DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable. If it does, run no secondary-authentication-server-group, which Cisco says lowers the VPN security posture. Network World flagged the same inconsistency.

What Cisco has not said about the attacks

The only statement on exploitation is one sentence: "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The advisory gives the month and nothing narrower.

Cisco firewalls are not the first to draw a short CISA window: the Ivanti Connect Secure chain got two deadlines 11 days apart, and Zyxel's GS1900 patch was bypassed after it shipped. Operators on any train in the table should move to the first fixed release for their branch. Until then, the two-line check above, run against every tunnel group including DefaultWEBVPNGroup, is the only way to know whether a given appliance is exposed.